Ubuntu 18.04 LTS – time drift causes TLS certificate validation errors

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

HTTPS and API calls fail because certificates appear expired or not yet valid.

Environment & Reproduction

Occurs on VMs with disabled NTP or unstable host clock synchronization.

Root Cause Analysis

System clock drift exceeds TLS validity tolerance for certificate verification.

Quick Triage

Compare system time against trusted source and check NTP synchronization status.

Step-by-Step Diagnosis

Inspect timedatectl, NTP peers, and hypervisor clock settings.

Solution – Primary Fix

Restore accurate time synchronization and restart affected services using TLS.

Solution – Alternative Approaches

Use alternative NTP servers or internal time source when upstream is unstable.

Verification & Acceptance Criteria

Clock offset remains low and TLS handshakes succeed for critical endpoints.

Rollback Plan

Revert time service changes if synchronization becomes less stable.

Prevention & Hardening

Monitor clock offset and enforce NTP health checks in baseline monitoring.

Related Errors & Cross-Refs

certificate has expired and certificate is not yet valid messages.

Related tutorial: View the step-by-step tutorial for Ubuntu 18.04 LTS.

View all Ubuntu 18.04 LTS tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

NTP, chrony, and TLS validation timing requirements on Linux systems.